svn commit: r286087 - head/sys/ofed/drivers/infiniband/core

[Mark Johnston]

Author: markj
Date: Thu Jul 30 18:28:37 2015
New Revision: 286087
URL: https://svnweb.freebsd.org/changeset/base/286087

Log:
  ib mad: fix an incorrect use of list_for_each_entry
  
  In tf_dequeue(), if we reach the end of the list without finding a
  non-cancelled element, "tmp" will be a pointer into the list head, so the
  tmp->canceled check is bogus. Use a flag instead.
  
  Submitted by:	Tao Liu <Tao.Liu at isilon.com>
  Reviewed by:	hselasky
  MFC after:	1 week
  Sponsored by:	EMC / Isilon Storage Division
  Differential Revision: https://reviews.freebsd.org/D3244

Modified:
  head/sys/ofed/drivers/infiniband/core/mad.c

Modified: head/sys/ofed/drivers/infiniband/core/mad.c
==============================================================================
--- head/sys/ofed/drivers/infiniband/core/mad.c	Thu Jul 30 18:28:34 2015	(r286086)
+++ head/sys/ofed/drivers/infiniband/core/mad.c	Thu Jul 30 18:28:37 2015	(r286087)
@@ -292,6 +292,7 @@ static struct tf_entry *tf_dequeue(struc
 	unsigned long flags;
 	unsigned long time_left;
 	struct tf_entry *tmp, *tmp1;
+	bool found = false;
 
 	spin_lock_irqsave(&tf->lists_lock, flags);
 	if (list_empty(&tf->fifo_head)) {
@@ -300,11 +301,13 @@ static struct tf_entry *tf_dequeue(struc
 	}
 
 	list_for_each_entry(tmp, &tf->fifo_head, fifo_list) {
-		if (!tmp->canceled)
+		if (!tmp->canceled) {
+			found = true;
 			break;
+		}
 	}
 
-	if (tmp->canceled) {
+	if (!found) {
 		spin_unlock_irqrestore(&tf->lists_lock, flags);
 		return NULL;
 	}